Privacy and Cookie Policy

Who is responsible for your data

For privacy questions and to exercise your rights, contact support@devosa.eu.

1. Controller and applicable law

DEVOSA is the trading name used by the controller identified above. We determine the purposes and means of the processing described here. This policy is provided under Articles 12–14 of Regulation (EU) 2016/679 (GDPR), the Slovenian Personal Data Protection Act (ZVOP-2) and, for cookies and similar storage, Article 225 of the Electronic Communications Act (ZEKom-2).

No data protection officer has been appointed. Please send privacy enquiries directly to the controller using the contact details above.

2. Data and sources

We receive the data you submit: name, company, email address, telephone number or messenger username, messages, project requirements, services, indicative budget, timing and communication preferences, and optional files. Attachments may contain other personal data; please include only information needed to discuss the project and avoid special-category data, identity documents, passwords or payment-card details.

When you access the website, the hosting infrastructure processes connection information such as IP address, request time, URL and browser or device information to deliver and protect the site. Our enquiry API does not write enquiry bodies or attachment names into application request logs. This does not exclude infrastructure, mail-delivery or security logs.

The sources are you, your browser and the communication service you use. If a colleague supplies your business contact details, we use them only for the relevant business communication and provide the applicable information no later than our first contact, first disclosure, or within one month, unless a GDPR exception applies.

3. Purposes and legal grounds

• Responding to your request and taking steps at your request towards a contract with you: Article 6(1)(b) GDPR.
• Correspondence with a company’s representative or another business contact: Article 6(1)(f). Our legitimate interest is handling relevant enquiries and establishing and managing business relationships.
• Delivering the website, preventing abuse and investigating technical or security incidents: Article 6(1)(f). Our legitimate interest is keeping the service available and secure.
• Retaining records where required by applicable law: Article 6(1)(c). Establishing, exercising or defending legal claims: Article 6(1)(f), limited to records needed for that purpose.
• Optional audience measurement using Google Analytics, once activated: Article 6(1)(a), together with prior consent required by ZEKom-2. Necessary storage of your privacy choice serves our legitimate interest in respecting and documenting that choice and falls within the exception for storage necessary for a service you request.

4. What you need to provide

You do not have to send an enquiry. The form requires a name and contact method so that we can address you and reply. Without sufficient contact information, we cannot respond. Other project information and attachments are optional. Providing enquiry data is not a statutory obligation. Additional details needed for a contract will be requested separately.

Sending an enquiry does not constitute consent to analytics, advertising or newsletters. Refusing analytics does not limit access to the website or our services.

5. Access and service providers

Website hosting and business email are provided by NEOSERV, operated by Avant.Si d.o.o., Poslovna cona A 49, 4208 Šenčur, Slovenia. NEOSERV processes website requests, email messages and attachments, mail delivery information and backups as needed to provide the services. Providers may use subprocessors; processing on our instructions is governed by the applicable data processing terms.

Enquiry details and files are intended for the business mailbox. The application sends Telegram only the fixed notification “Получена новая заявка” (“A new enquiry has been received”), after email acceptance; it does not include the sender’s name, contact details, message or files. This is separate from a conversation that you choose to start in Telegram. Enquiries and attachments are delivered to hello@devosa.eu through NEOSERV’s authenticated, encrypted mail service. no-reply@devosa.eu is the technical sender; replies and privacy requests should be sent to the contact addresses in this policy.

Personal data is intended only for the controller and authorised people who need access to handle an enquiry or operate the service. Professional advisers and public authorities may receive information where necessary for a legal duty or claim. Submitted enquiries are not published.

NEOSERV publishes data processing terms linked from section 10 of its general terms. DPA section 3.1 describes them as part of the provider–customer contractual relationship. This reference does not assert that a separate signed copy has been verified.

6. Telephone, WhatsApp, Telegram and external links

If you call us or choose WhatsApp or Telegram, we use the contact details and messages to respond through that channel, on the enquiry-related legal grounds above. The messaging provider also processes data under its own terms and privacy policy; choosing a messenger does not consent to unrelated marketing.

The website uses links to these services, rather than embedded messenger widgets. Opening a link transfers you to that provider, which may process technical information. Email remains an alternative. Avoid sending sensitive information through messaging channels.

• WhatsApp privacy policy
• Telegram privacy policy

7. Processing outside the EEA

NEOSERV’s published data processing agreement provides for storage in the EU and territories recognised by the EU as providing adequate protection; it is not an EU-only guarantee. Cloudflare is not part of the selected hosting setup. Google Analytics and messaging services may process data internationally, outside the EEA.

For our contracted processing, a transfer must be covered by an applicable adequacy decision under Article 45 GDPR or appropriate safeguards under Article 46, such as the European Commission’s standard contractual clauses, together with supplementary measures where needed. A reliance on the EU–US Data Privacy Framework requires the actual recipient and processing to fall within a valid certification.

The providers’ terms below describe their contractual transfer arrangements. They do not certify our specific account configuration. Before activating the enquiry integration or GA4, the applicable contracting entities, subprocessors and transfer mechanism must be verified. You can request information about the safeguards and a copy, subject to necessary redactions, at the privacy contact above.

• NEOSERV data processing agreement
• Google Analytics data processing terms

8. How long we keep data

For an enquiry that does not lead to a contract, we delete the personal data and attachments 12 months after the last substantive contact. This applies to correspondence and any copies under our control, including messages in a chosen messenger. If negotiations are genuinely continuing, they are not treated as a closed enquiry.

Where a contract follows, relevant information moves into the client file and is retained for performance of the agreement and the applicable statutory record-keeping periods. Only records necessary for a pending dispute, legal claim or mandatory preservation are retained beyond the ordinary period, until the relevant requirement ends. A possible future marketing campaign is not a reason to keep closed enquiries indefinitely.

NEOSERV states that backups are created daily, weekly and monthly, including email backups accessible through JetBackup 5. This describes backup frequency, not the maximum retention of each copy. NEOSERV’s published hosting data schedule includes backups and specifies removal from backup systems within 3–9 months after the hosting subscription expires. This is not the rolling backup lifetime or an extension of the 12-month period for active enquiry records. Retention periods for infrastructure backups, provider error/security logs and undelivered messages in the outgoing mail queue are determined by NEOSERV under the applicable service terms and server settings. These periods are separate from our retention of enquiries and Google Analytics data. Deleted records must not return to normal use after restoration.

The account’s Raw Access configuration shows log processing every 24 hours, archiving to the home directory, and removal of the previous month’s archived access logs at the end of each month. A custom retention period is not selected. This concerns these account-level access-log archives, not all provider security/error logs or backup copies of logs. Compression and processing every 24 hours do not mean deletion every 24 hours.

NEOSERV’s terms, section 4.1, state that server connection logs, including mail, webmail and web-server connections, are usually retained for 30–60 days depending on the service and server settings. This is not an unconditional maximum for every security/error log or backup.

NEOSERV’s published DPA, section 7.10, provides for deletion within 60 days after cooperation ends, except where legal retention or technical limitations apply, including system backups. This differs from our enquiry-retention period and the provider’s separate backup-removal schedule.

• NEOSERV hosting data and retention schedule
• NEOSERV backup and recovery information
• NEOSERV terms, section 4.1

9. Cookies, local storage and Google Analytics

Google Analytics 4 uses measurement ID G-1KY093JEVD. It loads only after you select “Allow analytics”. Before consent and after refusal, this integration does not load the Google tag or send Google Analytics requests, including consent-status or cookieless measurement pings.

Once enabled with consent, GA4 measures visits and page usage using cookie identifiers, page information and browser or device information. Google receives network requests, including the IP address used for the connection. The tag configuration disables Google signals and advertising personalisation and removes URL query strings and fragments from the explicitly supplied page location. We do not send form answers or files to GA4.

Enhanced measurement is enabled in the GA4 account. After analytics consent, it may record scrolling, outbound link clicks and form-start and form-submit interactions, including link URLs and form identifiers and destination URLs. These form events do not confirm successful delivery of an enquiry. The standard enhanced form events described by Google do not include the values entered in the form or uploaded file contents. Our application sends those details and attachments to our own enquiry endpoint, not deliberately to Analytics. The website has no built-in site search or embedded YouTube player; corresponding enhanced events are not expected during normal use. Enquiry submission uses POST so field values are not appended to the page URL by the form. Avoid including personal data in URLs, link labels or downloadable file names. We assess any new tracking or form functionality before introducing it.

The choice buttons are equally available; continued browsing is not consent. You can change your decision using “Cookie settings” in the footer or below. Withdrawal blocks further analytics, removes accessible first-party GA cookies and reloads the page to stop the running tag. It does not undo earlier lawful processing or automatically erase data already received by Google.

The 180-day preference validity and cookie lifetime are separate from server-side Analytics retention. In the GA4 account, event data retention is set to 2 months and user data retention to 14 months. Reset on new user activity is enabled: each new event restarts the retention period for that user identifier, so it can be retained for longer than 14 months from the first visit if activity continues. Aggregated reports may have different retention. Hosting security cookies, if introduced, must be assessed and disclosed before launch.

• How Google uses data
• Google privacy policy

10. Your rights

You may exercise the following rights, subject to the conditions and exceptions in the GDPR:

• Access to your data and information about its processing; correction of inaccurate or incomplete data.
• Erasure where the legal conditions are met, and restriction of processing in the cases provided by law.
• Data portability for data you provided, where processing is automated and based on consent or a contract.
• Objection to processing based on legitimate interests on grounds relating to your particular situation. We then stop unless overriding compelling legitimate grounds or a need for legal claims applies. Objection to direct marketing is unconditional.
• Withdrawal of consent at any time, without affecting the lawfulness of processing before withdrawal.

11. Making a request and complaints

Send your request to the privacy contact above; you can also write to the postal address. Requests are normally free of charge. We reply without undue delay and within one month of receipt. If complexity or the number of requests justifies an extension of up to two additional months, we notify you within the first month and explain why. We request additional identity information only where there are reasonable doubts and only to the extent necessary.

If we cannot fulfil a request, we explain the reasons and available remedies. You may complain to Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, Slovenia, gp.ip@ip-rs.si, or the supervisory authority where you habitually live or work or where the alleged infringement occurred. You do not have to contact us first and may seek a judicial remedy.

• Slovenian Information Commissioner

12. Automated decisions, marketing and updates

The website and enquiry workflow do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects. Optional traffic statistics are not used to decide whether to accept a client or set individual prices.

There is currently no newsletter subscription or marketing mailing workflow on this website. An enquiry is not a newsletter subscription. Before introducing marketing emails, we will establish the applicable legal basis and electronic-marketing requirements, provide the relevant information and an easy unsubscribe mechanism.

We update this policy when the processing changes. The date above identifies this version. We provide information about any new purpose before further processing and request fresh consent where required. The English, Slovenian and Russian versions are intended to communicate the same information; a translation does not restrict statutory rights.